// TOM'S HARDWARE US — HARDWARE & GADGET
Anthropic warns of self-replicating AI worm threat that doesn't need data centers to self-improve and spread
The threat is real, but still in the future, at least for now.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Anthropic's Frontier Red Team has demonstrated two components of a potential AI-powered worm that, if key issues with the practical implementation are resolved, could spread across consumer devices including inexpensive Android TV boxes and smart appliances, hypothetically without relying on datacenter infrastructure. The experiments show that AI agents can configure inference across different hardware platforms and orchestrate replication across a network. There are still some serious limitations, though, particularly around the gap between the capabilities of today's models versus the hardware constraints of potential targets.
In its October 12 report, titled "AI models may be capable of self-replicating without access to a datacenter," Anthropic examines a potential class of malware called a weight-based replicator. Rather than distributing conventional executable code, it would propagate AI model weights alongside the software infrastructure needed to run inference on compromised devices, and it's not pure theory, either.
The researchers demonstrated that Qwen3.5-9B can establish an inference server on eight of nine tested hardware types, spanning NVIDIA Jetson Nano devices, Apple Silicon Macs, Xeon servers, a Google TPU, AMD's MI300X, and at least one PC with an RTX 4090, among others. They also ran Gemma4-26B-A4B across 15 off-brand Android TV boxes costing approximately $55 each, achieving a combined generation rate of 0.39 tokens per second.
Anthropic also tested whether a model could orchestrate replication across a network. The experiment used eight Google Cloud nodes running Android 15 emulators. A seeded agent propagated between nodes through an unauthenticated Android Debug Bridge (ADB) port, transferring files and establishing an inference server on each target. GLM-5.2, a titanic model with 744 billion parameters over 1TB in size, completed the replication sequence across all eight nodes in four of five trials, reaching seven nodes in the remaining trial.
No other tested open-weight model was able to complete the sequence at all without orchestration from GLM-5.2, and they weren't able to meaningfully ask a larger model for help, either, despite being equipped with the capability. Naturally, GLM-5.2 wasn't actually replicating itself onto smart TV boxes; instead, it established an inference server for the much smaller Llama 3.1 8B on each target. GLM-5.2 ran on a separate inference server because the emulated nodes couldn't handle the larger model.
In other words, Anthropic demonstrated that a very large, externally hosted model can orchestrate a simplified replication sequence across machines with deliberately exposed ADB interfaces, and it showed that small models can set up inference, but it absolutely hasn't proven that a small model can independently replicate itself across consumer hardware. That distinction, admittedly fine, is nevertheless pretty important when the entire premise is that small models could soon spread without relying on datacenter infrastructure.
The experiments expose a central constraint of the research: models capable of reliably completing the replication sequence aren't currently small enough to run on inexpensive target devices, while models that fit within those devices' memory budgets, despite being capable of setting up inference, still can't reliably complete the entire process. This gap between the intelligence needed for reliable replication and the maximum model size that target hardware can support means that this threat model isn't really applicable right now, but Anthropic warns that gap could narrow, and potentially soon.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.